File: crashme.html

package info (click to toggle)
crashme 2.4-5
  • links: PTS
  • area: main
  • in suites: sarge, woody
  • size: 116 kB
  • ctags: 78
  • sloc: ansic: 868; makefile: 60; sh: 5
file content (339 lines) | stat: -rw-r--r-- 12,441 bytes parent folder | download | duplicates (4)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
<!doctype html public "-//IETF//DTD HTML//EN//2.0">
<!-- 
     This document is Copyright 1996 by George J. Carrette, 
     All Rights Reserved.
 -->  
<html>
<head><title>CRASHME: Random input testing.</title>
<META name="description"
  content="Using random input testing on the instruction set of a computation environment.">
<META name="keywords"
      content="security, testing, robustness, cybernetics">
</head>
<body>
<H1>CRASHME: Random input testing</H1>

<P>Copyright &copy; 1996 by <a href="gjc@world.std.com">George J. Carrette</a>. All rights Reserved.

<P>See the source crashme.c for reports of system crashes.
Source code is available as a gunzip tar file, 
<a href="crashme.tgz">crashme.tgz</a> or zip file 
<a href="crashme.zip">crashme.zip</a> or the old unix shar archive,
<a href="ftp://ftp.std.com/pub/gjc/crashme-2.4-shar">crashme-2.4-shar</a>.


<P>
Acknowledgements.

<P>
Many people have provided suggestions and comments and
feedback. Some in private email and some as published on the comp.arch
newsgroups.  But as the author of this gross hack I take full
responsibility for any errors in the information presented.

<HR>

<P>

A bit of background on crashme. It is a tool for testing the
robustness of an operating environment using a technique of "Random
Input" response analysis. This I first saw formally proposed in the
book Cybernetics by Norbert Wiener, but which any parent who has
observed his children playing and learning would be well disposed to
describe in detail. There is a wealth of information on
the web containing references to Mr Weiner and his work,
see for example <A href="http://www.ams.org/publications/notices/199504/wiener.html">www.ams.org</a> or <a href="http://rleweb.mit.edu/g-atshst.htm">rleweb.mit.edu</a>.

<UL>
<LI>The operating environment under consideration is the user-mode process.

<LI>The Random Input is provided by the execution of a sequence of pseudo-random data as an instruction stream.

<LI>The response analysis is to catch and record machine and software
generated exceptions/errors/signals and to retry using new random data
in both the current user-mode process and in newly created
subprocesses.

</UL>

<HR>

<P>Notes for release 2.2 of Crashme. 9-MAY-1994 GJC@WORLD.STD.COM

<P>Added the X.Y syntax for the NBYTES argument. This may run faster,
doing more tests per second. A reasonable value for Y would be
the number of bytes in a machine instruction.

<P>Many people have suggested that the output of previous versions was
far too verbose, and that that was not only annoying but also
effectively slowing down the program. Therefore there is a new argument
available after the subprocess control argument, which is a verboseness
level from 0 to 5. Using a level of 2 will print out only summary
information about the runs. e.g.

<BLOCKQUOTE><PRE><TT>
$ crashme +2000 666 50 00:30:00 2
Crashme: (c) Copyright 1990, 1991 George J. Carrette
Version: 1.7 25-SEP-1991
Subprocess run for 1800 seconds (0 00:30:00)
Test complete, total real time: 1801 seconds (0 00:30:01)
exit status ... number of cases
       1100 ...     2
    3522652 ...     4
       1036 ...     1
       1084 ...     7
       1108 ...    19
          1 ...   432
         12 ...   137
</TT></PRE></BLOCKQUOTE>

<P>The table of exit status codes and frequencies is a new interesting
aspect of the test. This test was run on a VMS system, so that we have
a normal process exit 432 times, access violation 137 times,
and reserved operand fault 19 times, etc. As the number of tries goes
up (50 in this case) we would expect that the number of normal process
exits to go down.

<P>If you define an environment variable (or vms logical name)
called CRASHLOG then each subprocess will append to a file the
arguments it was given. In that way you can recover what instance
possibly caused a crash, but remember that without frequent disk fsync
operations most Unix systems will leave a CRASHLOG that is out of
date by a few minutes or more.

<P>Here is some output supplied by nik@infonode.ingr.com on one of his machines.

<BLOCKQUOTE><PRE><TT>
Processor : Intergraph Clipper C300 RISC processor
            16Mb memory + 4k I cache and 4K D cache

Operating System: CLIX Version c.5.3.2
                  derived from AT&amp;T SVR 3.1 with BSD enhancements.

Crashme: (c) Copyright 1990, 1991 George J. Carrette
Version: 1.7 25-SEP-1991
Subprocess run for 9000 seconds (0 02:30:00)
Test complete, total real time: 9004 seconds (0 02:30:04)
exit status ... number of cases
        136 ...     1
      24576 ...     1
         14 ...     1
        138 ...    11
        135 ...    27
        140 ...    26
        132 ...   430
        139 ...    18
      12800 ...   567
</TT></PRE></BLOCKQUOTE>

<P>The status values here could be decoded by reading the
documentation for the "wait" system procedure, and looking up the
correct part of the value in the sys_errlist[] array. That is left as
an exersize for the reader.

<HR>

<P>To compile, some systems may need #include &lt;sys/types.h&gt;.

<P>Also, note the conditionalized code in bad_malloc. If your system
only gets the signal "segmentation violation" then you may need
to consider conditionalizations along this line. 

<P>However, on a machine with a segmented address space, that has
"instructions" in one segment and "data" in another, it is highly
unlikely that the code for setting up and invoking the "void
(*badboy)()" will have any interesting effect. Nothing other than an
easily handled SIGSEGV will result in the inner testing loop.

<P>Some PDP-11 systems would be examples of this situation (different
I and D space).

<P>---MACHINE O/S SPECIFIC NOTES---

<P>MACHINE:: DEC C (OPENVMS ALPHA AXP):

<BLOCKQUOTE><PRE><TT>
$ CC/PREFIX=ALL/NOOPTIMIZE CRASHME
$ LINK CRASHME
</TT></PRE></BLOCKQUOTE>

<P>New for version 2.2 code has been added to hackishly manipulate
the Procedure Descriptor data format. It seems be executing random
instructions like we would want.

<BLOCKQUOTE><PRE><TT>
#if defined(__ALPHA) && defined(VMS) && !defined(NOCASTAWAY)
</TT></PRE></BLOCKQUOTE>

<P>Without this hack crashme on this platform has very little chance
of causing anything other than a SIGBUS bus error.

<P>Perhaps a smart "learning" mode of random-data creation could
achieve the same ends, maximizing some measurement of punishment.
<A href="http://www.aaai.org/Conferences/National/1996/Tutorials/koza.html">Genetic programming</a> might be useful.

<P>Test I've tried:

<BLOCKQUOTE><PRE><TT>
$crashme +1000.48 0 100 03:00:00 2
</TT></PRE></BLOCKQUOTE>

<P>MACHINE:: Windows NT:
 
<P>The only files needed are crashme.c,makefile.wnt, and make.bat. cd
into the directory containing the files and you can make two versions.
crashme and crashmep (posix).

<BLOCKQUOTE><PRE><TT>
&gt;make  
</TT></PRE></BLOCKQUOTE>

<P>In WIN32 subsystem the subprocess-all-at-once mode has not been
implemented, but the sequential (-nsub) and timed modes have been
implemented.

<P>In posix subsystem you must use the full name of the file in the
command if you want to generate subprocesses.

<BLOCKQUOTE><PRE><TT>
&gt;crashmep.exe .....
</TT></PRE></BLOCKQUOTE>

On an 486DX2-66 machine the following caused a totally
wedged up machine in the Windows NT final release. (Build 511).
This was built in WIN32 mode with debugging on.

<BLOCKQUOTE><PRE><TT>
&gt;crashme +1000 666 50 12:00:00 3
</TT></PRE></BLOCKQUOTE>

<P>In the posix subsystem the more verbose modes were not ever observed
to go through more than 2 setjmp/longjmp cycles on a given random
number seed.  In the WIN32 subsystem there was a greater variety of
fault conditions.

<P>The above crash took place after about 6 hours of running. Final
subprocess arguments were +1000 24131 50, and we verified twice that
invoking the following crashed the OS within seconds.

<BLOCKQUOTE><PRE><TT>
&gt;crashme +1000 24131 50
</TT></PRE></BLOCKQUOTE>

<P>I have always been concerned that the more complex the unprotected
data in the user address space the more likely it is for a program
being developed to generate inscrutable errors that an "application
developer" level of person will be unable to understand.  And worse,
will end up spinning wheels for large amounts of time, thereby
delaying projects and risking deadline failures, and even worse,
forcing management to bring in super-experienced (and limited
availability) people into a project in order to get it going again.

<P>The WINDOWS NT client-server model is one way around this problem.
Having a subsystem in a different address space is one way to protect
complex data manipulated through an API. However, as page 127 of
"Inside Windows NT" there are some optimizations that make an unspoken
trade-off between the robustness afforded by a protected seperate
address space and efficiency of implementation on an API.

<P>Robustness and 'scrutability of failure situations' vs efficiency.

<P>MACHINE:: OS/2

<P>It has been reported that this runs when compiled gcc crashme.c -o
crashme.exe In order to disable the dialog boxes reporting abnormal
process termination, add this to CONFIG.SYS: AUTOFAIL=YES. Or the
following code to main:

<BLOCKQUOTE><PRE><TT>
DosError(FERR_DISABLEHARDERR | FERR_DISABLEEXCEPTION);
</TT></PRE></BLOCKQUOTE>

<P>Another person says that Emx is the only c compiler under OS/2 that
supports fork.

<HR>

<P>
Survey of Procedure Descriptor Usage. The emphasis here is on
currently shipping products. The program pddet.c included
with the distribution can be used to determine some of this
information. Note that in some environments, e.g. Microsoft C++ 4.0
the results of PDDET will be different depending on the compilation
modes chosen: debug verses release.

<BLOCKQUOTE><PRE><TT>
Architecture    |D| Desc | Env | Reg | Apos | Atyp | Rpos | Rtyp | 
------------------------------------------------------------------
VAX             |2| No   | No  | Yes | No   | No   | No   | No   |
ALPHA, OPENVMS  |3| Yes  | Yes | Yes | Yes  | Opt  | Yes  | Opt  |
ALPHA, WNT      | | No   |     |     |      |      |      |      |
ALPHA, OSF/1    | | No   |     |     |      |      |      |      |
RS/6000, AIX    |2| Yes  | Yes | No  | No   | No   | No   | No   |
PowerPC,        |2| Yes  | Yes | No  | No   | No   | No   | No   |
MIPS, Unix      | |      |     |     |      |      |      |      |
MIPS, WNT       | |      |     |     |      |      |      |      |
Intel, WNT      | |      |     |     |      |      |      |      |
Sparc, SUNOS    | | No   |     |     |      |      |      |      |
PA-RISC, HPUX   |2| Yes  |     |     |      |      |      |      |
------------------------------------------------------------------

Legend:

D    ... level of detailed information I have available
         1 = Verbal description or suspect from pddet.c
         2 = exact structure details including code for CRASHME.C
             or obvious what it is from pddet.c
         3 = crashme uses manufacturers include files for descriptors.
Desc ... Uses descriptors
Env  ... has pointer to non-static environment
Reg  ... describes registers used
Apos ... describes argument positions (stack, registers) or number.
Atyp ... describes argument types
Rpos ... describes return value position.
Rtyp ... describes return value types

Layout of Descriptors. Sizes in bytes.

ALPHA OPENVMS:

[FLAGS&amp;KIND]       2
[REG-SAVE]         2
[REG-FOR-RETPC]    1
[REG-FOR-RETVAL]   1
[SIGNATURE-OFFSET] 2
[START-PC]         8
[Other stuff ...]  from 8 to 32 bytes worth.

AIX 

actually points to a 3 word struct with:
 - the actual function address
 - Table Of Contents (r2) register value
 - Environment (r11) pointer (for nested functions)

POWERPC

[PROGRAM-COUNTER]
[TABLE-OF-CONTENTS]
[EXCEPTION-INFO]

</TT></PRE></BLOCKQUOTE>

<P>
[Editorial comment taken from comp.arch:] Not to sound picky about
this, but this is not really part of the POWER/PowerPC architecture.
There is no special support for this in the hardware, it is just the
scheme the software designers came up with in order to support shared
libraries. Other schemes would be possible. [GJC comment] Pretty
much true for every architecture.

<P>PA-RISC HPUX.

<P>The pddet.c program was used, and suggested descriptors of 8
bytes long. The -examine 8 argument showed what appeared to
be a 4-byte starting PC followed by a table of contents.
Note: If somebody knows what /usr/include/sys/*.h file to use
for this, please let me know.

</BODY>